fix(ci): apply lessons learned to monthly roadmap reminder cross-repo

[heitorlessa]

Signed-off-by: heitorlessa lessa@amazon.co.uk
Issue number: #4074

Summary

Main lesson learned is that when using cross-repo workflows that use local scripts, we must change the checkout in the target workflow to explicitly checkout itself.

What do I mean by that?

Take the following job in mind

jobs:
    call-workflow-passing-data:
        permissions:
            contents: read
            pull-requests: read
            issues: write  # create monthly roadmap report
        uses: aws-powertools/actions/.github/workflows/monthly_roadmap_reminder.yml@main
        secrets:
            token: ${{ secrets.GITHUB_TOKEN }}

There are two implicit designs that aren't easy to understand at first and docs don't call that out:

1. aws-powertools/actions is where the workflow is
2. monthly_roadmap_reminder.yml is the workflow name
3. The workflow runs in this repository

With that in mind, the target workflow naturally would try to do a code checkout as its first step. However, that code checkout will checkout this repository (Python source code), not the shared actions we want.

For this to work, the target workflow owned by aws-powertools/actions must explicitly pass which repository it will checkout code -- it can't be via ${{github.repo}} because it would resolve to powertools-lambda-python.

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
        with:
            # NOTE Since it's called from another repository
            # we must checkout the repository where the github-script is (aws-powertools/actions)
            # otherwise the caller check out their own repository code (e.g., Python/TS), where the github-scripts aren't available
            repository: aws-powertools/actions

A nicer benefit of this is that we don't need to control from the target who can call it and try to abuse creating GitHub issues in another place, because it's the caller repository that runs the workflow (it's not a fire-n-forget).

Changes

Please provide a summary of what's being changed

User experience

Please share what the user experience looks like before and after this change

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• Meet tenets criteria
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented
• PR title follows conventional commit semantics

Is this a breaking change?

RFC issue number:

Checklist:

• Migration process documented
• Implement warnings (if it can live side by side)

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[heitorlessa]

Don't merge - I forgot two things:

PR review status column, and point to main over SHA until we have actions releases

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud